hakurei

Author	SHA1	Message	Date
Ophestra	3385538142	nix: clean up flake outputs All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 32s Details Test / Fortify (push) Successful in 2m0s Details Test / Data race detector (push) Successful in 2m32s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 12:26:19 +09:00
Ophestra	2d4cabe786	nix: increase nixfmt max width All checks were successful Test / Create distribution (push) Successful in 30s Details Test / Fpkg (push) Successful in 36s Details Test / Data race detector (push) Successful in 35s Details Test / Fortify (push) Successful in 39s Details Test / Flake checks (push) Successful in 50s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-28 14:43:46 +09:00
Ophestra	8bf162820b	nix: separate fsu from package All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Run NixOS test (push) Successful in 7m25s Details This appears to be the only way to build them with different configuration. This enables static linking in the main package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-23 18:13:37 +09:00
Ophestra	6ae02e72fa	nix: test direct_wayland behaviour All checks were successful Test / Create distribution (push) Successful in 47s Details Test / Run NixOS test (push) Successful in 3m35s Details This should never be used outside tests unless you absolutely know what you're doing or are using GNOME. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 10:45:27 +09:00
Ophestra	989fb5395f	nix: remove unused configuration All checks were successful Test / Create distribution (push) Successful in 49s Details Test / Run NixOS test (push) Successful in 3m30s Details User setup no longer depends on userdb. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 10:10:42 +09:00
Ophestra	8d04dd72f1	nix: mount nvidia devices All checks were successful Test / Create distribution (push) Successful in 1m43s Details Test / Run NixOS test (push) Successful in 3m33s Details These non-standard paths are required in the sandbox for nvidia drivers to work. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 18:05:18 +09:00
Ophestra	016da20443	nix: expose compat flag in nixos module All checks were successful Test / Create distribution (push) Successful in 1m55s Details Test / Run NixOS test (push) Successful in 4m6s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 12:42:48 +09:00
Ophestra	efacaa40fa	nix: set deny_devel correctly All checks were successful Test / Create distribution (push) Successful in 1m55s Details Test / Run NixOS test (push) Successful in 3m51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-24 00:50:35 +09:00
Ophestra	96d5d8a396	nix: apply shared home config to reserved aid All checks were successful Build / Create distribution (push) Successful in 2m16s Details Test / Run NixOS test (push) Successful in 5m43s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 20:48:04 +09:00
Ophestra	8a00a83c71	nix: expose syscall filter policy All checks were successful Build / Create distribution (push) Successful in 1m31s Details Test / Run NixOS test (push) Successful in 1m52s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 17:24:42 +09:00
Ophestra	134247b57d	nix: configure target users via nixos All checks were successful Build / Create distribution (push) Successful in 2m0s Details Test / Run NixOS test (push) Successful in 3m46s Details This makes patching home-manager no longer necessary. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 17:04:19 +09:00
Ophestra Umiker	4d3bd5338f	nix: implement flake checks All checks were successful test / test (push) Successful in 36s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-16 20:54:28 +09:00
Ophestra Umiker	39e3ac3ccd	nix: require /etc/userdb nix-daemon All checks were successful test / test (push) Successful in 36s Details There seems to be some kind of credential caching in nix-daemon. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 21:07:57 +09:00
Ophestra Umiker	40cc8a68d1	nix: rename home directories All checks were successful test / test (push) Successful in 38s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-12-07 20:15:37 +09:00
Ophestra Umiker	95668ac998	nix: expose no_new_session in module All checks were successful test / test (push) Successful in 14s Details Useful for shells and terminal programs like chat clients. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-28 00:19:06 +09:00
Ophestra Umiker	653d69da0a	nix: module descriptions All checks were successful test / test (push) Successful in 24s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 18:10:57 +09:00
Ophestra Umiker	f8256137ae	nix: separate module options from implementation All checks were successful test / test (push) Successful in 25s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-19 17:08:22 +09:00
Ophestra Umiker	54b47b0315	nix: copy pixmaps directory to share package All checks were successful test / test (push) Successful in 21s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 14:46:08 +09:00
Ophestra Umiker	8f3f0c7bbf	nix: integrate dynamic users All checks were successful test / test (push) Successful in 21s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-18 02:49:48 +09:00
Ophestra Umiker	1a09b55bd4	nix: remove portal paths from default All checks were successful test / test (push) Successful in 27s Details Despite presenting itself as a generic desktop integration interface, xdg-desktop portal is highly flatpak-centric and only supports flatpak and snap in practice. It is a significant attack surface to begin with as it is a privileged process which accepts input from unprivileged processes, and the lack of support for anything other than fortify also introduces various information leaks when exposed to fortify as it treats fortified programs as unsandboxed, privileged programs in many cases. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-10 22:24:17 +09:00
Ophestra Umiker	9a13b311ac	app/config: rename map_real_uid from use_real_uid All checks were successful test / test (push) Successful in 19s Details This option only changes mapped uid in the user namespace. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-09 12:01:34 +09:00
Ophestra Umiker	431aa32291	nix: remove absolute Exec paths All checks were successful test / test (push) Successful in 26s Details Absolute paths set for Exec causes the program to be launched as the privileged user. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-08 02:05:47 +09:00
Ophestra Umiker	ad80be721b	nix: improve start script All checks were successful test / test (push) Successful in 23s Details Zsh store path in shebang. Replace writeShellScript with writeScript since runtimeShell is not overridable. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 14:09:41 +09:00
Ophestra Umiker	4d90e73366	nix: generate strict sandbox configuration All checks were successful test / test (push) Successful in 22s Details Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-11-06 04:25:15 +09:00
Ophestra Umiker	b9d5fe49cb	nix: pass $SHELL for shell interpreter Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-12 23:01:06 +09:00
Ophestra Umiker	8f03ddc3fa	app: remove bubblewrap launch method Launch methods serve the primary purpose of setting UID in the init namespace, which bubblewrap does not do. Furthermore, all applications will start within a bubblewrap sandbox once it has been implemented. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-10-10 00:11:04 +09:00
Ophestra Umiker	3d963b9f67	nix: include package buildInputs in devShells Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-17 23:15:33 +09:00
Ophestra Umiker	d49b97b1d4	nix: pass method string directly Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-13 11:58:45 +09:00
Ophestra Umiker	88ac05be6d	nix: fix typo in nixos module implementation previously missed due to lazy eval Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-09 23:29:16 +09:00
Ophestra Umiker	396066de7b	nix: implement dbus-system option in nixos module Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-09 21:26:14 +09:00
Ophestra Umiker	0e5b85fd42	nix: implement new dbus options in nixos module Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-09 04:58:25 +09:00
Ophestra Umiker	60e4846542	nix: provide options for capability flags Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-08 02:45:00 +09:00
Ophestra Umiker	945cce2f5e	nix: implement nixos module Signed-off-by: Ophestra Umiker <cat@ophivana.moe>	2024-09-04 17:03:21 +09:00

33 Commits